How to tell whether your identity protection is actually working

There is no honest single number for how well your identity protection is working, and any article offering you one has invented it. What you can do is verify, control by control, that the things you believe are in place actually are — because the common failure here is not that a measure was weak, but that it was never completed, or was quietly lifted and never restored.

What you are actually measuring

Not risk reduction. Nobody publishes a figure for how much a given combination of measures reduces your chance of being a victim, and the honest position is to say so rather than to borrow a percentage from a marketing page.

What you can measure is completeness and currency: is each control present, and is it still present today. That is a checklist, not a score, and it is the useful kind of measurement because every item on it has a specific fix.

The other reason to run this as a checklist is that these items fail quietly. A freeze lifted for a car loan does not announce itself when nobody puts it back, and a fraud alert expires without sending a notification. Nothing tells you. You have to look.

Type the address yourself

Get to AnnualCreditReport.com by typing the address, not by searching or following a link. The FTC warns about sites using terms like “free report” in their names and URLs that purposely misspell the real one, and it is the only authorised place for the free reports you are entitled to by law. The phone route is 1-877-322-8228.

Also worth fixing in mind before you begin: AnnualCreditReport.com and the credit bureaus will not email you asking for your Social Security number or account information.

The checks

1. Log in to each bureau in turn — Equifax, Experian, TransUnion — and confirm a freeze is active. Three separate confirmations, because freezes are placed and lifted per bureau.
2. If you have lifted a freeze in the last year for a credit application, confirm it was put back once the need for the check passed.
3. Pull all three credit reports and read them for the FTC’s four signs: accounts you don’t recognise, charges you didn’t make, withdrawals you didn’t make, and a bill that has stopped arriving.
4. Check the expiry on any fraud alert. An initial alert is free for one year and can be renewed; an extended alert runs seven years; an active duty alert one year.
5. Confirm your prescreened-offer opt-out at optoutprescreen.com or 1-888-5-OPT-OUT is still within its five-year window, or make it permanent by signing and returning the Permanent Opt-Out Election form.
6. Check you can reach IdentityTheft.gov and know the phone number — 877-438-4338, 9:00am–5:00pm ET — before you need them.

What a clean result does and does not prove

A clean pass means the preventive measure is genuinely in force: with a freeze at all three bureaus, nobody can open a new credit account in your name, including you. That is a strong statement about new credit and only about new credit.

It says nothing about fraud on cards you already hold, about a compromised email account, about medical or tax identity theft, or about a breach that has not yet been used. Reading the reports covers some of that ground; the rest is watched through your own bank and card statements.

It also does not mean nothing has happened. The FTC’s list exists because identity theft is often first visible as a small anomaly — a missing statement, a charge you half-remember. A clean control check and an unread statement is not a clean result.

How often to repeat this

• Reports: free weekly from each bureau, permanently extended, so quarterly is comfortably achievable.
• Freeze status: after every occasion you lift one, and once a year regardless.
• Fraud alerts: at the anniversary, since initial alerts expire after one year.
• Prescreen opt-out: before the five years elapse. Expect offers to keep arriving for several weeks after a request — requests are processed within five days, but the mail takes longer to stop.
• After any breach notification: all of the above, immediately.

Sources: FTC — What to know about credit freezes and fraud alerts · FTC — Free credit reports · FTC — What to know about prescreened offers of credit and insurance · FTC — What to know about identity theft · FTC IdentityTheft.gov

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FTC. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.